Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65913DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

Medium 6.1

In plain English

A medium-severity prototype pollution in DOMPurify from cure53. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 75.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-dompurify	no fix listed	DEBIAN-CVE-2026-65913
Debian:13	node-dompurify	no fix listed	DEBIAN-CVE-2026-65913
Debian:14	node-dompurify	3.3.2+dfsg-1	DEBIAN-CVE-2026-65913
Ubuntu:22.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-65913
Ubuntu:24.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-65913
npm	dompurify	3.3.2	GHSA-cj63-jhhr-wcxv

Affected products (as reported)

Vendor	Product	Versions
cure53	DOMPurify	0 – before 3.3.2

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-cj63-jhhr-wcxv) vendor-advisory
VulnCheck Advisory: DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES third-party-advisory